Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 21:44
General
- Target 2026-06-04_7e5acd3da28f7cb0ef653a1a62b38e4e_amadey_coinminer_elex_emotet_hellokitty_icedid_remcos_smoke-loader_wannacry.exe
- Size 3.4MB
- Sample260604-1lgrlsfz5z
- SHA256 ceb4a8bec5139b226b4cacd798d013c22705e8de8a53e7380e3f4082fa3e7ec4
Malware Config
Extracted
-
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\!! READ ME !!.txt
- Greetings! Unfortunately we have to report you that your company were compromised. All your files were encrypted and you can't restore them without our private key. Trying to restore it without our help may cause complete loss of your data. Also we researched whole your corporate network and downloaded all your sensitive data to our servers. If we will not get any contact from you in 3 next days we will public it in our news site. You can find it there ( http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/�) Tor Browser is needed ( https://www.torproject.org/download/�) Also we respect your work and time and we are open for communication. In that case we are ready to discuss recovering your files and work. We can grant absolute privacy and compliance with agreements by our side. Also we can provide all necessary evidence to confirm performance of our products and statements. Feel free to contact us with quTox ( https://tox.chat/download.html�) Our ToxID: 37790E2D198DFD20C9D2887D4EF7C3E2951BB84248D192689B64DCCA3C8BD808A1895676B271 Alternative method is email: [email protected] Mark your messages with your personal ID: GA6GD342D0
-
http://cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion/�
-
https://tox.chat/download.html�
Signatures
- Family: Cuba, COLDDRAW
Cuba aka COLDDRAW is a ransomware first seen in 2019.
- Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
- Detect PurpleFox Rootkit 7 IoCs
Detect PurpleFox Rootkit.
- Gh0st RAT payload 8 IoCs
- UPX dump on OEP (original entry point) 9 IoCs
- Drops file in Drivers directory 1 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 3 IoCs
- Drops file in System32 directory 6 IoCs
- UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_7e5acd3da28f7cb0ef653a1a62b38e4e_amadey_coinminer_elex_emotet_hellokitty_icedid_remcos_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_7e5acd3da28f7cb0ef653a1a62b38e4e_amadey_coinminer_elex_emotet_hellokitty_icedid_remcos_smoke-loader_wannacry.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_2026-06-04_7e5acd3da28f7cb0ef653a1a62b38e4e_amadey_coinminer_elex_emotet_hellokitty_icedid_remcos_smoke-loader_wannacry.exeC:\Users\Admin\AppData\Local\Temp\HD_2026-06-04_7e5acd3da28f7cb0ef653a1a62b38e4e_amadey_coinminer_elex_emotet_hellokitty_icedid_remcos_smoke-loader_wannacry.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del C:\Users\Admin\AppData\Local\Temp\HD_2026-06-04_7e5acd3da28f7cb0ef653a1a62b38e4e_amadey_coinminer_elex_emotet_hellokitty_icedid_remcos_smoke-loader_wannacry.exe >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240665625.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "Remote Data"1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
stable.identity_helper.exe.manifest
!! READ ME !!.txt
HD_2026-06-04_7e5acd3da28f7cb0ef653a1a62b38e4e_amadey_coinminer_elex_emotet_hellokitty_icedid_remcos_smoke-loader_wannacry.exe
HD_X.dat
N.exe
R.exe
240665625.txt
Remote Data.exe
memory/1972-114-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1972-45-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/1972-69-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3376-25-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3376-28-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/3376-27-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/4116-19-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/4116-20-0x0000000010000000-0x00000000101B6000-memory.dmp
memory/4116-17-0x0000000010000000-0x00000000101B6000-memory.dmp